Docker "--provenance"/"--sbom" Attestations Break --load or an Older Registry
buildx attaches provenance and SBOM attestations by default for registry pushes. Those attestations make the output a manifest list with extra attestation manifests, which a plain --load cannot import and some older registries cannot store.
What this error means
A build with default attestations fails on --load (the result is an unexpected manifest list) or on push to an older registry that rejects the attestation manifests. Disabling provenance/SBOM makes the same build succeed.
ERROR: docker exporter does not currently support exporting manifest lists
# (default provenance turned a single-platform --load build into a manifest list)
# or on push: manifest invalid: unsupported manifest media typeCommon causes
Default provenance makes the output a manifest list
When buildx adds a provenance attestation, even a single-platform build becomes a manifest list (image + attestation). --load into the classic store then fails the same way a multi-arch build would.
The registry cannot store attestation manifests
Older or limited registries may reject the attestation manifest media types, failing the push with an "unsupported"/"manifest invalid" error.
How to fix it
Disable attestations when loading or targeting an old registry
Turn off provenance/SBOM so the output is a plain single-platform image.
docker buildx build --provenance=false --sbom=false --load -t myorg/api:1.4.2 .Control attestations in build-push-action
The action exposes a provenance input; set it to false for incompatible targets.
- uses: docker/build-push-action@v6
with:
push: true
provenance: false
sbom: falseHow to prevent it
- Keep provenance/SBOM on for registries that support them.
- Disable attestations for
--loadand legacy-registry pushes. - Confirm your registry supports attestation manifests before relying on them.